WO2019202929A1

WO2019202929A1 - Sharing system

Info

Publication number: WO2019202929A1
Application number: PCT/JP2019/012915
Authority: WO
Inventors: 智広土屋; 雅彦大矢; 将宏荒川; 雄一稲波
Original assignee: 株式会社東海理化電機製作所
Priority date: 2018-04-18
Filing date: 2019-03-26
Publication date: 2019-10-24
Also published as: JP2019191647A

Abstract

A sharing system (21) is provided with: a right addition unit (48 (48a-48c)) for adding, to a valet key (41), a valet key operation right (Dk2) for enabling the operation by the valet key (41) of a to-be-shared object (19); and a re-addition processing unit (49 (49a-49c)) that, when the object (19) being shared is returned, adds a new valet key operation right (Dk3) for return, which is separate from the valet key operation right (Dk2) already registered in a portable terminal (23), to the valet key (41).

Description

Sharing system

The present invention relates to a sharing system that enables a shared object to be used among a plurality of people.

Conventionally, a car sharing system in which a single vehicle (shared vehicle) is used among a plurality of people is known as a sharing system in which one share object is commonly used by a plurality of people (see Patent Documents 1 and 2). ). In this type of car sharing system, for example, car share use is registered in advance, for example, a vehicle reservation is made with a mobile terminal (high function mobile phone or the like), and use of the vehicle is permitted within the reservation time. .

JP 2016-115077 A JP 2016-71834 A

By the way, in this kind of car sharing system, it is assumed that the vehicle is returned using the valet parking service. At this time, for example, a vehicle operation authority is given to the bullet key through communication or the like from the portable terminal, and the vehicle operation with the bullet key is permitted. However, in this case, the usage period of the valet key is a time corresponding to the valid time of the operation authority preset in the mobile terminal at the time of vehicle reservation (the reservation time specified by the mobile terminal). For this reason, there is a possibility that the valid time of the bullet key may suddenly expire during the use of the bullet parking service, or the bullet key may be used for a longer time than the user intends. Therefore, the vehicle cannot be safely returned by the valet parking service.

An object of the present invention is to provide a sharing system that enables a safe return of an object to be shared.

A sharing system according to an embodiment includes a sharing device provided in a shared object, a bullet key capable of operating the shared object, and key information necessary for using the shared object, and the sharing And a portable terminal capable of operating the share target object when authenticated through communication with the apparatus. The sharing system further includes an authority granting unit that grants the bullet key operating authority to the bullet key that enables the manipulation of the share object using the bullet key, and the portable terminal when the share object is returned. A re-granting processing unit for newly granting a return bullet key operation authority different from the previously-registered bullet key operation authority to the bullet key.

According to this configuration, when returning an object to be shared using a bullet key, a return bullet key operation authority used only at the time of the return is newly granted to the bullet key, and sharing is performed with this bullet key. Make the object operable. The return bullet key operating authority to be given at this time is an exclusive authority that is used only when returning the shared object, and is therefore an authority content specialized for the return work. Therefore, it is possible to return the share object safely.

In the sharing system, the reassignment processing unit may delete information in the memory of the mobile terminal when the return bullet key operation authority is granted to the bullet key when the share object is returned. preferable. According to this configuration, the portable terminal can be disabled after the share object is returned, which is further advantageous in improving the security against unauthorized use of the share object.

In the sharing system, it is preferable that the reassignment processing unit automatically deletes the return bullet key operating authority given to the bullet key when a prescribed condition is satisfied. According to this configuration, it is possible to erase the operation authority given to the bullet key when returning the shared object, which is further advantageous in improving the security against unauthorized use of the shared object.

In the sharing system, the return bullet key operation authority granted by the re-grant processing unit is permitted to use the share object, but the use of the share object by the user is not permitted. Unauthorized operation authority. According to this configuration, after the operation authority is re-assigned, the user is not affected even if the share target is used. Therefore, it becomes difficult to use the shared object unintended by the user.

According to the present invention, it is possible to safely return an object to be shared.

The block diagram of the sharing system of one Embodiment. Explanatory drawing which shows the procedure of user authentication. Explanatory drawing which shows the procedure of the vehicle operation by a portable terminal. Explanatory drawing which shows the procedure which gives the operation authority to a bullet key. (A) is a schematic diagram which shows the flow in the case of returning a vehicle by valet parking service, (b) is a state diagram of each memory at the time of destination arrival. The flowchart which shows the procedure of the return process of a vehicle. The flowchart which shows the procedure at the time of giving drop-off key information to the bullet key 41. FIG. The flowchart which shows the procedure when receiving a valet parking service. The flowchart which shows the procedure which deletes automatically the key information 3 for discarding the bullet key. (A) is a schematic diagram showing a flow of renting a vehicle in the valet parking service, (b) is a state diagram of each memory at the time of vehicle reservation by another user. The flowchart which shows the procedure when another user makes a reservation of vehicle use. The flowchart which shows the procedure when giving the operation authority of a vehicle to a bullet key from another user's portable terminal. The flowchart which shows the procedure at the time of invalidating the operation authority provided to the bullet key. The flowchart which shows the procedure of the user authentication by another user.

Hereinafter, an embodiment of a sharing system will be described with reference to FIGS.
As shown in FIG. 1, the vehicle 1 includes an electronic key system 4 that performs ID verification with the electronic key 2 wirelessly to execute or permit the operation of the in-vehicle device 3. The electronic key system 4 is a key operation-free system that executes ID collation (smart collation) by narrow-band radio in response to communication from the vehicle 1. The key operation free system automatically performs ID verification without directly operating the electronic key 2. The in-vehicle device 3 includes, for example, a door lock device 5 and an engine 6.

The vehicle 1 includes a verification ECU (Electronic Control Unit) 9 that performs ID verification, a body ECU 10 that manages the power supply of the on-vehicle electrical components, and an engine ECU 11 that controls the engine 6. These ECUs 9 to 11 are electrically connected via a communication line 12 in the vehicle. The communication line 12 is, for example, CAN (Controller Area Network) or LIN (Local Interconnect Network). In each memory (not shown) of the verification ECU 9 and the electronic key 2, an electronic key ID of the electronic key 2 registered in the vehicle 1 and an electronic key unique encryption key used for authentication of ID verification are registered. The body ECU 10 controls the door lock device 5 that switches between locking and unlocking the vehicle door 13.

The vehicle 1 includes a radio wave transmitter 16 that transmits radio waves and a radio wave receiver 17 that receives radio waves. Although not shown, the radio wave transmitter 16 includes, for example, an outdoor unit that transmits radio waves outdoors and an indoor unit that transmits radio waves indoors. The radio wave transmitter 16 transmits radio waves in the LF (Low Frequency) band. The radio wave receiver 17 receives radio waves in the UHF (Ultra High Frequency) band. The electronic key system 4 communicates with the electronic key 2 by bidirectional communication of LF-UHF.

When the wake signal for activating the electronic key 2 is LF transmitted from the radio wave transmitter 16, when the electronic key 2 enters the communication area of the wake signal and receives it, the electronic key 2 is activated from the standby state and communicates with the verification ECU 9 ( ID verification (smart verification) is executed through (smart communication). The smart verification includes, for example, electronic key ID verification for confirming whether the electronic key ID is correct, challenge response authentication using an encryption key (in this example, an electronic key unique encryption key), and the like. When confirming that the outdoor electronic key 2 and ID verification (outdoor smart verification) are established, the verification ECU 9 permits or executes the locking and unlocking of the vehicle door 13 by the body ECU 10.

When the collation ECU 9 confirms that the indoor electronic key 2 and ID collation (indoor smart collation) are established, the collation ECU 9 permits the power switch operation by the engine switch 18. Accordingly, for example, when the engine switch 18 is operated in a state where the brake pedal is depressed, the engine 6 is started.

The vehicle 1 includes a sharing system 21 in which a single vehicle 1 (shared object 19) is shared by a plurality of people. The sharing system 21 of this example registers the encrypted key information Dk from the outside (in this example, the server 22) to the mobile terminal 23, and between the mobile terminal 23 and the sharing device 24 provided in the vehicle 1 The key information Dk is authenticated, and the authentication result is used as one condition for whether or not the vehicle 1 can be operated. The key information Dk is preferably a one-time key (one-time password) that is permitted to be used only once, for example.

The portable terminal 23 includes a terminal control unit 27 that controls the operation of the portable terminal 23, a network communication module 28 that performs network communication, a short-range wireless module 29 that performs short-range wireless communication, and a memory 30 that can rewrite data. With. When the mobile terminal 23 acquires the key information Dk from the server 22 through network communication, the mobile terminal 23 writes and stores this key information Dk in the memory 30. The near field communication is preferably, for example, Bluetooth (registered trademark).

The mobile terminal 23 includes a user interface application 31 that manages the operation of the sharing system 21. The user interface application 31 is installed in the terminal control unit 27 by, for example, being downloaded from the server 22. By executing the user interface application 31, the terminal control unit 27 implements various processes such as a reservation procedure for the vehicle 1, user authentication, vehicle operation, operation authority assignment, and operation authority return.

The sharing device 24 is independent of the hardware of the electronic key system 4 of the vehicle 1 and is separately attached to the vehicle 1. The sharing device 24 is a position of an electronic key that is effective only when, for example, the vehicle 1 is reserved for use. Power is supplied to the sharing device 24 from the battery + B of the vehicle 1.

The sharing device 24 includes a controller 34 that controls the operation of the sharing device 24, a smart communication block 35 that performs smart communication, a short-range wireless module 36 that performs short-range wireless communication, and a memory 37 that can rewrite data. And a timer unit 38 for managing the date and time. Whether or not the controller 34 can correctly decrypt the key information Dk with the encryption key in the memory 37 (in this example, the sharing device unique encryption key) when the key information Dk is received from the portable terminal 23 through short-range wireless communication. Is confirmed to determine whether or not the portable terminal 23 is valid. The timer unit 38 is composed of, for example, a soft timer. The sharing device 24 has a one-to-one relationship with the vehicle 1 by associating the sharing device ID registered therein with the vehicle ID (body number).

As shown in FIG. 2, in step 101, when the mobile terminal 23 makes a reservation for using the vehicle 1, the mobile terminal 23 performs user authentication through the server 22 and network communication. In the user authentication of this example, for example, login (user ID and password authentication) and a vehicle reservation procedure are performed. In the vehicle reservation procedure, for example, the vehicle used and the date and time are input. The user ID and password are input to the portable terminal 23 and transmitted to the server 22 through network communication. When the server 22 receives the user ID and password from the portable terminal 23, the server 22 authenticates them and continues the process if the authentication is established, and forcibly terminates the process if the authentication is not established.

In step 102, when the user authentication is established, the server 22 generates key information Dk and transmits it to the portable terminal 23. In the case of this example, the server 22 generates key information Dk using, for example, an encryption key (for example, a sharing device unique encryption key) of the sharing device 24 mounted on the reserved vehicle. As the key information Dk in this example, a plaintext including data elements such as “reservation date and time”, “terminal ID”, and “user authentication key” is used as a predetermined encryption key (for example, a sharing device-specific encryption key). This is a ciphertext generated by encrypting with an encryption method (encryption algorithm). The terminal ID is a unique ID of the mobile terminal 23. The user authentication key is a kind of key used in encrypted communication between the mobile terminal 23 and the sharing device 24 when the vehicle 1 is operated with the mobile terminal 23, for example.

In step 103, the portable terminal 23 transmits the key information Dk registered therein by the short-range wireless communication at the start of use of the reserved vehicle. The key information Dk is transmitted to the sharing device 24 through, for example, BLE (Bluetooth Low Energy).

In step 104, when the sharing device 24 receives the key information Dk from the portable terminal 23, the sharing device 24 performs an authentication operation of the key information Dk. In the case of this example, the sharing device 24 decrypts the key information Dk using an encryption key (for example, a sharing device-specific encryption key) and confirms whether or not the decryption is successful. At this time, if the decryption of the key information Dk is successful, the key information Dk received from the portable terminal 23 is correct, so that the authentication of the key information Dk is successful. If the authentication of the key information Dk is successful, the sharing device 24 can acquire “reservation date / time”, “terminal ID”, and “user authentication key” included in the key information Dk.

When the authentication of the key information Dk is established, the sharing device 24 shifts to the “authentication completed state” of the key information Dk, and the key function for operating the sharing device 24 as the electronic key 2 is valid (the key function is on). It becomes. Therefore, the sharing device 24 can execute smart communication (smart function) through the electronic key system 4. Further, the sharing device 24 writes and stores the key information Dk and the user authentication key in the memory 37 when the authentication of the key information Dk is established. On the other hand, if the authentication of the key information Dk is not established, the sharing device 24 determines that the key information Dk is incorrect and disconnects the BLE communication.

When the authentication of the key information Dk is established, the sharing device 24 notifies the mobile terminal 23 of the user authentication key acquired in this authentication by short-range wireless communication. When the mobile terminal 23 receives the user authentication key from the sharing device 24, it registers it in the memory 30. As described above, the user authentication key is registered in both the portable terminal 23 and the sharing device 24.

As shown in FIG. 3, in step 201, when the portable terminal 23 moves to the authentication completion state, and an operation request button (display button on the screen) is operated on the portable terminal 23, an operation request corresponding to the button is made. The signal is transmitted to the sharing device 24 by short-range radio. The operation request button is operated, for example, when the vehicle door 13 is unlocked, the unlock request button operated when the vehicle door 13 is locked, and when the vehicle 1 is allowed to start the engine 6. There is an engine start request button. The operation request signal is a signal including a command corresponding to the operated operation request button. The operation request signal is transmitted after being encrypted with a user authentication key, for example.

In step 202, when the operation request signal is received from the mobile terminal 23, the sharing device 24 performs smart communication with the verification ECU 9, and notifies the verification ECU 9 of the operation request signal received from the mobile terminal 23. In the case of this example, the sharing device 24 performs smart verification using the electronic key ID and encryption key registered in itself, and in the verification process, the operation request signal received from the portable terminal 23 is sent to the verification ECU 9. Notice.

In step 203, when the collation ECU 9 confirms that the smart collation with the sharing device 24 is established, the collation ECU 9 executes an operation according to the operation request signal notified from the sharing device 24. Thereby, locking / unlocking of the vehicle door 13 and permission of engine start operation are performed.

As shown in FIG. 4, the sharing system 21 is compatible with a valet parking service that requests parking or the like from a third party such as a valet staff. In the case of this example, when renting the vehicle 1 to a third party, the vehicle 1 is lent by passing the valet key 41 to a third party such as a valet staff. The bullet key 41 is a kind of vehicle key (electronic key 2) that can operate the vehicle 1, and is used as a vehicle key lent to a third party. Note that the communication between the bullet key 41 and the vehicle 1 is not limited to Bluetooth, and may be, for example, normal smart communication. Even in this case, the communication between the bullet key 41 and the portable terminal 23 is preferably Bluetooth.

The bullet key 41 includes a key control unit 42 that controls the operation of the bullet key 41, an operation unit 43 that is operated when the vehicle 1 is operated by the bullet key 41, a communication module 44 that is capable of short-range wireless communication, and data And a rewritable memory 45. The communication module 44 communicates with the mobile terminal 23 and the sharing device 24 through, for example, Bluetooth communication. The operation unit 43 includes an unlock operation unit that is operated when the vehicle door 13 is unlocked, a lock operation unit that is operated when the vehicle door 13 is locked, and an engine start permission that is operated when the engine start is permitted. There are an operation unit and a power supply operation unit that is operated when the power of the bullet key 41 is turned on and off.

The sharing system 21 includes an authority grant unit 48 that grants the operation authority of the vehicle 1 from the portable terminal 23 to the bullet key 41. The authority granting part 48 of this example includes a first authority granting part 48 a provided in the server 22, a second authority granting part 48 b provided in the mobile terminal 23, and a third authority granting part provided in the bullet key 41. 48c. When the first authority grant unit 48a generates key information for the portable terminal 23 (hereinafter referred to as first key information Dk1), key information for the bullet key 41 (hereinafter referred to as second key information Dk2) is also generated. The first key information Dk1 and the second key information Dk2 are also generated and transmitted to the mobile terminal 23. When the mobile terminal 23 and the bullet key 41 communicate (Bluetooth communication), the second authority grant unit 48b transmits the second key information Dk2 for the bullet key 41 to the bullet key 41, and the third authority grant unit 48c The second key information Dk2 is registered in the bullet key 41.

The first key information Dk1 includes “reservation date and time” when the vehicle 1 is used on the mobile terminal 23, “terminal ID” of the mobile terminal 23, and “user authentication key” used in encrypted communication between the mobile terminal 23 and the sharing device 24. "And other data elements. The second key information Dk2 includes “reservation date and time” when the vehicle 1 is used with the bullet key 41, “terminal ID” of the bullet key 41, and “user” used in encrypted communication between the sharing device 24 and the bullet key 41. Includes data elements such as "authentication key".

The sharing system 21 includes a reassignment processing unit 49 that grants a new operation authority of the vehicle 1 to the user when the vehicle 1 is returned. The reassignment processor 49 includes a first reassignment processor 49 a provided in the server 22, a second reassignment processor 49 b provided in the mobile terminal 23, and a third reassignment process provided in the bullet key 41. Part 49c. When returning the vehicle 1, the reassignment processing unit 49 returns a bullet key operation authority (transfer key information) different from the bullet key operation authority (second key information Dk 2) already registered in the mobile terminal 23. Dk3) is newly assigned to the bullet key 41.

Next, operations and effects of the sharing system 21 according to the present embodiment will be described with reference to FIGS.
As shown in FIG. 5A, it is assumed that the user who has borrowed the vehicle 1 arrives at the destination and drops off the vehicle 1. In this case, the user performs a return process by passing the vehicle 1 and the bullet key 41 to a serviceman or the like. At this time, as shown in FIG. 5B, since the vehicle 1 was used by the user before arrival at the destination, the memory 52 of the server 22, the memories of the mobile terminal 23 and the sharing device 24, respectively. In 30, 37, the first key information Dk1 and the second key information Dk2 are already registered. On the other hand, the operation authority of the vehicle 1 is not given to the bullet key 41, and neither the first key information Dk1 nor the second key information Dk2 is written in the memory 45.

FIG. 6 is a flowchart showing a procedure when a legitimate user who has borrowed the vehicle 1 arrives at the destination and performs a return process of the vehicle 1 (use example shown in FIG. 5). As shown in the figure, in step 301, when the mobile terminal 23 performs a return operation of the vehicle 1 in a state in which the mobile terminal 23 is in communication connection with the sharing device 24, the mobile terminal 23 notifies that effect. A return notification is transmitted to the sharing device 24. The return operation of the vehicle 1 is preferably an operation of displaying a return button on the screen of the mobile terminal 23 and tapping this, for example.

In step 302, when the sharing device 24 receives the return notification from the portable terminal 23, the sharing function 24 turns off the key function. That is, the key function that has been previously turned on in the sharing device 24 is switched off.

In step 303, the sharing device 24 transmits a return response to the mobile terminal 23 when the key function is turned off.
In step 304, the portable terminal 23 and the sharing device 24 disconnect the communication between the portable terminal 23 and the sharing device 24 after the key function is turned off. Thereafter, the sharing apparatus 24 shifts to an advertisement packet (hereinafter referred to as “advertisement”) transmission state.

In step 305, the server 22 (first reassignment processing unit 49a) and the mobile terminal 23 (second reassignment processing unit 49b) perform key information Dk (first key information Dk1 and second key registered in the mobile terminal 23). The return process of information Dk2) is executed. Return processing of the key information Dk (first key information Dk1 and second key information Dk2) is started, for example, by connecting the mobile terminal 23 to the server 22 and transmitting a return start request from the mobile terminal 23 to the server 22. .

In step 306, when receiving the return start request from the mobile terminal 23, the server 22 (first re-granting processing unit 49a) confirms the mobile terminal 23 that has notified the return start request, and uses the mobile terminal 23 that is renting the vehicle. If it can be recognized, a return permission is transmitted to the portable terminal 23.

In step 307, when the portable terminal 23 (second reassignment processing unit 49b) receives the return permission from the server 22, the key information Dk (first key information Dk1 and second key information) written in the memory 30 of the portable terminal 23 is received. The key information Dk2) is deleted. That is, the first key information Dk1 and the second key information Dk2 acquired at the time of vehicle reservation are erased from the memory 30.

In step 308, the portable terminal 23 (second reassignment processing unit 49b) inputs a drop-off rental reservation as a temporary use reservation of the vehicle 1 after the key information is returned. The procedure for the lending and lending reservation is, for example, the same processing as the user authentication performed at the time of the above-described vehicle reservation, and for example, a user ID, a password, a vehicle to be used, etc. are input. After inputting the necessary items, the return rental reservation button on the screen is tapped on the portable terminal 23.

In step 309, the portable terminal 23 (second reassignment processing unit 49 b) transmits the input data at the time of the reserved lending reservation to the server 22. The server 22 executes user authentication based on the input data at the time of the lending and lending reservation from the mobile terminal 23. The server 22 (first reassignment processing unit 49a) continues the process if the user authentication is established, and forcibly terminates the process if the user authentication is not established.

In step 310, the server 22 (first reassignment processing unit 49a) generates the drop-off key information Dk3 necessary for permitting temporary vehicle use after the vehicle is returned. The drop-off key information Dk3 is constructed from the same data elements as the first key information Dk1 and the second key information Dk2. The drop-off key information Dk3 includes “use time” when the vehicle 1 is temporarily used with the bullet key 41, “terminal ID” of the bullet key 41, and “user authentication” used in encrypted communication between the sharing device 24 and the bullet key 41. Key ”(information different from that included in the second key information Dk2) and the like.

In step 311, the server 22 (first reassignment processing unit 49 a) transmits the generated drop-off key information Dk 3 to the mobile terminal 23.
In step 312, when the portable terminal 23 (second reassignment processing unit 49 b) receives the drop-off key information Dk 3 from the server 22, it writes and saves this drop-off key information Dk 3 in the memory 30. As described above, in the portable terminal 23, the drop-off key information Dk3 is registered instead of the first key information Dk1 and the second key information Dk2 registered at the time of vehicle reservation.

FIG. 7 is a flowchart showing a procedure for giving the drop-off key information Dk3 as “return bullet key operation authority” to the bullet key 41 from the portable terminal 23. As shown in the figure, in step 401, the bullet key 41 starts advertisement transmission of Bluetooth communication based on, for example, operation of the operation unit 43 (operation of the power supply operation unit). In addition, it is preferable that the operation at this time is, for example, a long press of the power supply operation unit.

In step 402, the mobile terminal 23 and the bullet key 41 connect Bluetooth (BLE) communication. In this case, for example, when the portable terminal 23 returns a connect request to the advertisement of the bullet key 41, the communication is connected when the bullet key 41 receives the connect request.

In step 403, the bullet key 41 (third reassignment processing unit 49c) transmits a challenge request for requesting transmission of a challenge code to the mobile terminal 23 when communication with the mobile terminal 23 is connected.

In step 404, when receiving the challenge request from the bullet key 41, the portable terminal 23 (second reassignment processing unit 49b) transmits a challenge code used for challenge response authentication to the bullet key 41.

In step 405, upon receiving the challenge code from the mobile terminal 23, the bullet key 41 (third reassignment processing unit 49c) generates a response code using its own encryption key. Then, the bullet key 41 (third reassignment processing unit 49 c) transmits the generated response code to the mobile terminal 23.

In step 406, when the mobile terminal 23 (second reassignment processing unit 49 b) receives the response code from the bullet key 41, the mobile terminal 23 compares the response code obtained through the same calculation with itself and executes response verification. At this time, if the response code calculated by the portable terminal 23 matches the response code calculated by the bullet key 41, the response verification is established and the processing is continued. On the other hand, if these response codes do not match, the response verification is not established and the process is forcibly terminated.

In step 407, the portable terminal 23 (second reassignment processing unit 49b) transmits the drop-off key information Dk3 generated by itself to the bullet key 41 when the response verification is established. That is, the portable terminal 23 (second re-assignment processing unit 49b) grants the drop-off key information Dk3 to the bullet key 41, thereby permitting temporary use of the vehicle 1. This drop-off key information Dk3 can be used only by the bullet key 41.

In step 408, upon receiving the drop-off key information Dk3 from the portable terminal 23, the bullet key 41 (the third reassignment processing unit 49c) writes it into the memory 45. Thereby, the bullet key 41 can be temporarily used as a vehicle key.

In step 409, upon completion of writing the drop-off key information Dk3 to the memory 45, the bullet key 41 (third reassignment processing unit 49c) transmits a reception response to that effect to the portable terminal 23.

In step 410, the portable terminal 23 and the bullet key 41 disconnect the communication (Bluetooth communication) connection. Thereby, the communication between the portable terminal 23 and the bullet key 41 is terminated.

In step 411, the portable terminal 23 (second reassignment processing unit 49 b) deletes the information in the memory 30 after transmitting the drop-off key information Dk 3 to the bullet key 41. That is, all the key information Dk is erased from the memory 30 of the portable terminal 23, and the vehicle operation cannot be performed on the portable terminal 23.

FIG. 8 is a flowchart showing a procedure for receiving the valet parking service. In step 501, the sharing device 24 performs periodic advertisement transmission. In the case of this example, the transmission of advertisement is continued after the key function of the sharing device 24 is turned off.

In step 502, the sharing device 24 and the bullet key 41 connect Bluetooth (BLE) communication. In this case, for example, when the bullet key 41 returns a connect request to the advertisement of the sharing device 24, the communication is connected when the sharing device 24 receives the connect request.

In step 503, the sharing device 24 transmits a key information request for requesting notification of the key information Dk to the bullet key 41.
In step 504, upon receiving the key information request from the sharing device 24, the bullet key 41 shares the drop-off key information Dk3 registered in the bullet key 41 and the terminal ID that is the unique ID of the bullet key 41. Transmit to the ring device 24.

In step 505, the sharing device 24 executes terminal ID authentication for authenticating the terminal ID of the bullet key 41 that is currently communicating. The terminal ID authentication is authentication for comparing the terminal ID obtained by decrypting the drop-off key information Dk3 in the sharing device 24 with the terminal ID received directly from the bullet key 41. At this time, if the terminal ID authentication is established, the process is continued, and if the terminal ID authentication is not established, the process is forcibly terminated.

In step 506, the sharing device 24 executes a reservation time check for confirming whether or not the reservation time notified from the bullet key 41 is valid. The reservation time verification is authentication for comparing the reservation date and time obtained by decrypting the drop-off key information Dk3 in the sharing device 24 with the current time of the timer unit 38. At this time, if the reservation time collation is established, the process is continued, and if the reservation time collation is not established, the process is forcibly terminated.

In step 507, the sharing device 24 writes the drop-off key information Dk3 to the memory 37 when both terminal ID authentication and reservation time verification are established. In this example, the user authentication key calculated from the drop-off key information Dk3 is also written in the memory 37 in addition to the drop-off key information Dk3 and the terminal ID for the bullet key 41.

In step 508, when the information writing to the memory 37 is completed, the sharing device 24 notifies the bullet key 41 of the user authentication key obtained by the calculation. Upon receiving the user authentication key from the sharing device 24, the bullet key 41 writes and stores it in the memory 45. As a result, encrypted communication using the user authentication key is possible between the sharing device 24 and the bullet key 41.

In step 509, the bullet key 41 transmits a key-on request to the sharing device 24 after the user authentication key is written.
In step 510, when the sharing device 24 receives a key-on request from the bullet key 41, the sharing device 24 turns on the key function. As a result, the sharing device 24 can execute smart communication (smart verification) through the electronic key system 4.

In step 511, when the key function is turned on, the sharing device 24 transmits a key-on notification to that effect to the bullet key 41. Thereby, the bullet key 41 recognizes that the key function of the sharing device 24 is turned on. And the service person starts the engine 6 of the vehicle 1 using the bullet key 41, and parks the vehicle 1 in a predetermined position.

FIG. 9 is a flowchart showing a procedure for automatically deleting the drop-off key information Dk3 of the bullet key 41. In step 601, the bullet key 41 (third reassignment processing unit 49c) communicates with the sharing device 24 regardless of the connection state after a certain period of time has elapsed since the drop-off key information Dk3 was assigned to the bullet key 41. Disconnect.

In step 602, the bullet key 41 (third reassignment processing unit 49c) deletes the information in the memory 45. That is, the drop-off key information Dk3 and the user authentication key written in the memory 45 of the bullet key 41 are deleted from the memory 45. As a result, the bullet key 41 cannot be used.

Suppose that another user newly makes a reservation for the vehicle 1 as shown in FIG. In this case, for example, a serviceman unlocks the vehicle door with the bullet key 41, starts the engine 6 and carries the vehicle 1 to another user. Then, the rental process of the vehicle 1 is performed from the service person to another user, and the other user receives the vehicle 1 and the bullet key 41. At this time, as shown in FIG. 10B, another user newly makes a reservation for the vehicle 1, so any of the

memories

30, 37, 45, of the server 22, the portable terminal 23, and the sharing device 24. Also in 52, the first key information Dk1 and the second key information Dk2 are not registered.

FIG. 11 is a flowchart showing a procedure when another user makes a reservation for using the vehicle 1 with his / her mobile terminal 23. In step 701, when the user performs a procedure for using the vehicle 1 with the mobile terminal 23, the mobile terminal 23 acquires user data input during the use procedure. In this use procedure, as described above, for example, a user ID, a password, a use date and time of the vehicle 1 and the like are input. The portable terminal 23 transmits user data acquired by the use procedure to the server 22. At this time, the mobile terminal 23 also transmits the terminal ID of the mobile terminal 23 and the terminal ID of the bullet key 41 as user data.

In step 702, when receiving the user data from the mobile terminal 23, the server 22 (first authority grant unit 48a) generates key information Dk. At this time, the server 22 (first authority grant unit 48a) issues not only new first key information (hereinafter referred to as new first key information Dk1 ′) to be issued to the mobile terminal 23, but also to the bullet key 41. New second key information (hereinafter referred to as new second key information Dk2 ′) is generated. The server 22 (first authority giving unit 48a) transmits the generated new first key information Dk1 'and new second key information Dk2' to the mobile terminal 23. The new first key information Dk1 'and the new second key information Dk2' include different user authentication keys.

In step 703, when the portable terminal 23 (second authority grant unit 48b) receives the new first key information Dk1 ′ and the new second key information Dk2 ′ from the server 22, the new first key information Dk1 ′ and the new second key information Dk1 ′ are received. The key information Dk2 ′ is written and stored in the memory 30. As a result, the new first key information Dk1 'and the new second key information Dk2' are registered in the portable terminal 23 of another user.

FIG. 12 is a flowchart showing a procedure when the “operation authority” (new second key information Dk2 ′) of the vehicle 1 is given to the bullet key 41 from the portable terminal 23 of another user. As illustrated in FIG. 12, in step 801, the bullet key 41 is switched to a power-on state, for example, when the operation unit 43 is operated. The power-on operation is preferably an operation of the power operation unit of the bullet key 41, for example.

In step 802, when the bullet key 41 is switched to power-on, it starts advertising transmission of Bluetooth communication.
In step 803, the portable terminal 23 inputs a selection operation of the bullet key 41 for connecting the Bluetooth communication. That is, the connection destination of Bluetooth communication is selected in the portable terminal 23 of another user.

In step 804, the mobile terminal 23 and the bullet key 41 connect Bluetooth (BLE) communication. In this case, for example, when an advertisement and a connect request are exchanged, communication is connected.

In step 805, when communication with the mobile terminal 23 is connected, the bullet key 41 (third authority grant unit 48c) transmits a challenge request for requesting transmission of a challenge code to the mobile terminal 23.

In step 806, when the portable terminal 23 (second authority grant unit 48 b) receives the challenge request from the bullet key 41, it transmits a challenge code used for challenge response authentication to the bullet key 41.

In Step 807, upon receiving the challenge code from the portable terminal 23, the bullet key 41 (third authority grant unit 48c) generates a response code using its own encryption key. Then, the bullet key 41 (third authority granting unit 48 c) transmits the generated response code to the mobile terminal 23.

In step 808, when the mobile terminal 23 (second authority grant unit 48b) receives the response code from the bullet key 41, the mobile terminal 23 compares the response code obtained through the same calculation with itself and executes response verification. At this time, if the response code calculated by the portable terminal 23 matches the response code calculated by the bullet key 41, the response verification is established and the processing is continued. On the other hand, if these response codes do not match, the response verification is not established and the process is forcibly terminated.

In Step 809, when the response verification is established, the mobile terminal 23 (second authority grant unit 48 b) transmits the new second key information Dk <b> 2 ′ for the bullet key 41 registered in itself to the bullet key 41. That is, the portable terminal 23 (second authority granting part 48 b) gives the second key information Dk 2 ′ (valet key operation authority) for operating the vehicle 1 with the bullet key 41 to the bullet key 41. The new second key information Dk2 'can be used only with the bullet key 41.

In step 810, upon receiving the new second key information Dk2 'from the mobile terminal 23, the bullet key 41 (third authority grant unit 48c) writes the new second key information Dk2' in the memory 45. Thereby, the bullet key 41 can be used as a vehicle key.

In Step 811, the mobile terminal 23 (second authority grant unit 48 b) sets the mobile terminal 23 of another user to the bullet key valid mode. When the mobile terminal 23 enters the bullet key valid mode, the mobile terminal 23 is in an “unusable” state where it cannot be used as a vehicle key.

In step 812, the mobile terminal 23 and the bullet key 41 disconnect the communication (Bluetooth communication). Thereby, the communication between the portable terminal 23 and the bullet key 41 is terminated. Then, the service person starts the engine 6 of the vehicle 1 using the bullet key 41 and dispatches the vehicle 1 to a predetermined position. Note that the operation for operating the vehicle 1 with the bullet key 41 is the same as the step 401 to the step 411 in FIG.

FIG. 13 is a flowchart showing a procedure for invalidating the “operation authority” (new second key information Dk2 ′) given to the bullet key 41 from the portable terminal 23. In FIG. 13, steps 901 to 904 are the same processing as steps 801 to 804 described above (see FIG. 12), and thus description thereof is omitted.

In step 905, when the user performs an operation of invalidating the operation authority of the bullet key 41 on the mobile terminal 23, the mobile terminal 23 (second authority granting unit 48b) inputs this operation authority invalidation request. In the case of this example, the invalidation operation of the operation authority of the bullet key 41 is preferably an aspect in which, for example, an invalidation request button is displayed on the screen of the mobile terminal 23 and this button is selected and operated.

In step 906, the portable terminal 23 (second authority grant unit 48 b) transmits a challenge code when an operation for invalidating the operation authority is performed on the portable terminal 23.
In step 907, upon receiving the challenge code from the mobile terminal 23, the bullet key 41 (third authority granting unit 48c) generates a response code using its own encryption key. Then, the bullet key 41 (third authority granting unit 48 c) transmits the generated response code to the mobile terminal 23.

In step 908, when the portable terminal 23 (second authority grant unit 48b) receives the response code from the bullet key 41, the portable terminal 23 compares the response code obtained through the same calculation with itself and executes response verification. At this time, if the response code calculated by the portable terminal 23 matches the response code calculated by the bullet key 41, the response verification is established and the processing is continued. On the other hand, if these response codes do not match, the response verification is not established and the process is forcibly terminated.

In step 909, when the response verification is established, the mobile terminal 23 (second authority grant unit 48 b) transmits an invalidation request for invalidating the operation authority given to the bullet key 41.

In step 511, upon receiving the invalidation request from the mobile terminal 23, the bullet key 41 (third authority grant unit 48c) invalidates the operation authority of the vehicle 1. In the case of this example, the new second key information Dk2 '(user authentication key) written in the memory 45 of the bullet key 41 is deleted. As a result, the vehicle 1 cannot be operated with the bullet key 41.

In step 911, the mobile terminal 23 and the bullet key 41 disconnect the communication (Bluetooth communication). Thereby, the communication between the portable terminal 23 and the bullet key 41 is terminated.

In step 912, the bullet key 41 turns off the power. Thereby, the bullet key 41 is shifted to the standby state.
FIG. 14 is a flowchart illustrating a procedure when user authentication is performed between the mobile terminal 23 and the sharing device 24. This is a procedure performed when another user uses the vehicle 1 with his / her mobile terminal 23.

In step 1001, the portable terminal 23 and the sharing device 24 connect Bluetooth (BLE) communication. In this case, for example, when the mobile terminal 23 returns a connect request to the advertisement of the sharing device 24, the communication is connected when the sharing device 24 receives the connect request.

In step 1002, the sharing apparatus 24 transmits a key information request for requesting the bullet key 41 to notify the key information Dk.
In step 1003, when the mobile terminal 23 receives the key information request from the sharing device 24, the mobile terminal 23 obtains the new first key information Dk1 ′ registered in the mobile terminal 23 and the terminal ID that is the unique ID of the mobile terminal 23. To the sharing device 24.

In step 1004, the sharing device 24 executes terminal ID authentication for authenticating the terminal ID of the mobile terminal 23 that is currently communicating. The terminal ID authentication is an authentication for comparing the terminal ID obtained by decrypting the new first key information Dk1 ′ in the sharing device 24 with the terminal ID received directly from the mobile terminal 23. At this time, if the terminal ID authentication is established, the process is continued, and if the terminal ID authentication is not established, the process is forcibly terminated.

In step 1005, the sharing apparatus 24 executes a reservation time check for confirming whether or not the reservation time notified from the mobile terminal 23 is valid. The reservation time collation is authentication for comparing the reservation date and time obtained by decrypting the new first key information Dk1 'in the sharing device 24 with the current time of the timer unit 38. At this time, if the reservation time collation is established, the process is continued, and if the reservation time collation is not established, the process is forcibly terminated.

In step 1006, the sharing device 24 writes the new first key information Dk1 'to the memory 37 when both terminal ID authentication and reservation time verification are established. In the case of this example, in addition to the new first key information Dk1 ′ and the terminal ID of the portable terminal 23, the user authentication key calculated from the new first key information Dk1 ′ is also written in the memory 37.

In the subsequent steps 1007 to 1010, the same processing as in the above-described steps 508 to 511 is executed, and the key function of the sharing device 24 is turned on. As described above, the mobile terminal 23 of another user can be used as a vehicle key.

In the case of this example, when returning the vehicle 1 using the bullet key 41, a return bullet key operating authority (transfer key information Dk3) used only at the time of the return is newly assigned to the bullet key 41. And the vehicle 1 can be operated with the bullet key 41. The return bullet key operation authority (drop-off key information Dk3) to be given at this time is a dedicated authority used only when the vehicle 1 is returned, and is therefore an authority content specialized for return work. Therefore, the vehicle 1 can be safely returned using the valet parking service.

The reassignment processing unit 49 deletes the information in the memory 30 of the portable terminal 23 when the return bullet key operating authority (the drop-off key information Dk3) is granted to the bullet key 41 when the vehicle 1 is returned. Therefore, since the portable terminal 23 can be disabled after the vehicle 1 is returned, it is further advantageous in improving security against unauthorized use of the vehicle 1.

When the reassignment processing unit 49 assigns the drop-off key information Dk3 to the bullet key 41, the re-assignment processing unit 49 sets the drop-off key information Dk3 assigned to the bullet key 41 when a prescribed condition is satisfied (for example, a certain time has elapsed). Let it be erased automatically. Therefore, it is possible to delete the drop-off key information Dk3 assigned to the bullet key 41 when the vehicle 1 is returned, which is further advantageous in improving the security against unauthorized use of the vehicle 1.

Even though the return bullet key operation authority (discard key information Dk3) granted by the reassignment processing unit 49 is permitted to use the vehicle 1, the operation authority is not considered to be the use of the vehicle 1 by the user. It is. For example, the return bullet key operation authority (drop-off key information Dk3) granted by the re-assignment processing unit 49 is an operation authority that is not charged when using the vehicle 1. As a result, after the return bullet key operation authority (removal key information Dk3) is re-assigned, the user is not affected even if the vehicle 1 is used. Therefore, it becomes difficult to use the vehicle 1 that is not intended by the user.

The operation authority is key information Dk used in authentication between the portable terminal 23 and the sharing device 24, and this key information Dk is a one-time key that can be used only once. Therefore, the situation in which the key information Dk is illegally used and the vehicle 1 is operated is less likely to occur, which is advantageous in improving security against unauthorized use.

The authority grant unit 48 allows the authorized user to use the bullet key 41 during normal use by providing the bullet key 41 with the second key information Dk2 for the bullet key 41 acquired when the vehicle 1 is reserved for use. . Thereby, when the vehicle 1 is returned, only the process of updating the second key information Dk2 for the bullet key 41 registered in the portable terminal 23 during the reservation procedure of the vehicle 1 to the drop-off key information Dk3 is sufficient. Therefore, the operation imposed on the user when the vehicle 1 is returned can be simplified.

In addition, this embodiment can be implemented with the following modifications. The present embodiment and the following modifications can be implemented in combination with each other within a technically consistent range.
-Both the operation authority given initially and the operation authority given at the time of return of the vehicle 1 are not limited to being a one-time key (key information Dk), These may be different types of information.

The content included in the drop-off key information Dk3 may be information different from the content included in the key information Dk at the start of use.
The writing start of the drop-off key information Dk3 to the bullet key 41 is not limited to a long press of the power operation unit, but is changed to other modes such as an operation using the operation unit 43 other than the power operation unit. May be.

The re-granted operation authority may be registered in the bullet key 41 in a manner different from the operation authority given to the mobile terminal 23 at the start of use.
The erasure of the drop-off key information Dk3 is not limited to the condition that a certain time has elapsed. For example, you may change into other parameters, such as use frequency and time.

The sharing device 24 may be retrofitted to the vehicle 1 or may be pre-assembled to the vehicle 1.
The sharing device 24 may be integrated with the verification ECU 9, and these may be one unit part.

-The mounting location of the sharing device 24 is not particularly limited.
The reservation procedure for the vehicle 1 is not limited to being performed by the mobile terminal 23 but may be performed by the bullet key 41, for example.

The reservation procedure for the vehicle 1 may be performed using only the bullet key 41, for example, without passing through the portable terminal 23.
-Authentication of the portable terminal 23 and the sharing apparatus 24 is not limited to authentication of the key information Dk, It can change into another method.

The operation authority is not limited to the method of giving the key information Dk to the other party, and may be changed to another method such as a method of giving a use permission command.
-Short-range wireless communication is not limited to Bluetooth communication, but can be changed to another communication method.

The key information Dk is not limited to a one-time key, and may be information that is restricted in use.
The content included in the key information Dk can be changed to a mode other than the embodiment.
The key information Dk is not limited to being generated by the server 22, and may be anywhere as long as it is external.

· The encryption key used for encryption communication may be any key among, for example, a sharing device unique encryption key, a user authentication key, and an electronic key unique encryption key. For example, switching the encryption key used during the process is advantageous in improving the security of communication. Further, the encryption key to be used is not limited to the above-described key, and may be changed to various types.

The mobile terminal 23 is not limited to a high-function mobile phone, and can be changed to various terminals.
The portable terminal 23 and the sharing device 24 may acquire the user authentication key by any procedure or method.

・ The key function can be switched on under any condition.
The authority grant unit 48 and the re-grant processing unit 49 are not limited to those functionally generated by the user interface application 31, but may be generated by other methods or may be constructed from hardware elements. .

The operation-free electronic key system 4 is not limited to a system that performs smart verification while arranging transmitters inside and outside the vehicle and determining the inside / outside position of the electronic key 2. For example, a system may be used in which antennas (LF antennas) are arranged on the left and right sides of the vehicle body, and the position of the electronic key 2 inside and outside the vehicle is determined by checking the combination of responses of the electronic key 2 to radio waves transmitted from these antennas.

The ID verification imposed on the electronic key system 4 is not limited to verification including challenge response authentication, and may be any authentication or verification as long as at least electronic key ID verification is performed.

The electronic key system 4 may be, for example, a wireless key system that performs ID collation triggered by communication from the electronic key 2.
The electronic key 2 is not limited to a smart key (registered trademark), and may be a wireless key.

The verification ECU 9 and the sharing device 24 are not limited to a wireless communication method, and may be connected by wire, for example. In this case, various commands are transmitted from the sharing device 24 to the verification ECU 9 via a wire. Even in this case, the verification ECU 9 can be operated by a command from the sharing device 24.

The sharing device 24 is not limited to the configuration using the electronic key system when operating the share object 19. In this case, the sharing device 24 directly sends a command to a controller (CPU) that controls the operation of the share object 19 to operate the share object 19. In this configuration, the key function of the sharing device 24 can be omitted.

The sharing system 21 is not limited to being applied to the vehicle 1, but may be applied to other devices and devices such as a house (sharing house), a shared delivery box, and a coin parking. Therefore, the share target 19 is not limited to the vehicle 1 and can be changed to another target.

Next, the technical idea that can be grasped from the embodiment and the modified examples will be described.
(A) A sharing method,
Import key information necessary for using shared objects to mobile devices,
Authenticating the portable terminal through communication with a sharing device provided in the sharing target, and enabling the sharing target to be operated by the portable terminal when the portable terminal is authenticated;
Granting the bullet key the authority to operate the shared object with the bullet key,
When returning the shared object, a sharing method comprising: newly giving a return bullet key operation authority different from the bullet key operation authority already registered in the mobile terminal to the bullet key .

Claims

A sharing device provided for the share object;
A bullet key capable of operating the share object;
Capturing key information necessary for use of the shared object, and a portable terminal capable of operating the shared object when authenticated through communication with the sharing device;
A sharing system comprising:
An authority granting unit that grants a bullet key operation authority to the bullet key to enable operation of the shared object by the bullet key;
When returning the shared object, a re-granting processing unit newly granting the bullet key operation authority for return different from the bullet key operation authority already registered in the mobile terminal;
Sharing system with
The reassignment processing unit deletes the information in the memory of the portable terminal when the return bullet key operation authority is granted to the bullet key when returning the shared object,
The sharing system according to claim 1.
The reassignment processing unit automatically deletes the return bullet key operating authority given to the bullet key when a prescribed condition is satisfied,
The sharing system according to claim 1 or 2.
The return bullet key operation authority granted by the re-grant processing unit is an operation authority that is not considered to be used by the user even if the use of the share object is permitted. ,
The sharing system according to any one of claims 1 to 3.